To recover a self-hosted secrets manager, back up more than its database: preserve the product’s stored data, configuration, credentials, and other deployment-specific files or volumes, using a consistent method supported by that product and storage backend. Protect the backup as sensitive data, then rehearse restoring it in a controlled environment. The exact procedure depends on the manager and how it is deployed; OpenBao and Bitwarden, for example, do not share one universal backup or restore process.
Plan for the recovery you actually need
Start by documenting what runs the service and where its state lives. A database copy may not be enough to rebuild a working instance: configuration, encryption or data-protection material, attachments, certificates, plugins, and deployment definitions can also matter. The appropriate recovery set depends on the product and its architecture.
As an Amazon Associate I earn from qualifying purchases.
- Identify the installation: record the product and version, deployment type, storage backend, and whether the database is built in or external.
- Map the recovery set: locate persistent data, configuration files, credentials and keys required to run the service, plus any attachments, scripts, plugins, or persistent volumes.
- Set a recovery point objective: decide how much recent data the organization can afford to lose. A restore from an older backup rolls the service back to that backup’s point in time.
- Set a recovery time objective: decide how long the service can be unavailable while data and infrastructure are restored. There is no universal target suitable for every deployment.
- Secure and separate access: restrict who can read or copy backups. They may contain secrets, tokens, private keys, passwords, or authentication-related data. Do not leave the only copy of a decryption key with the backup it unlocks.
Keep a short recovery runbook with the backup location, required software and configuration, access arrangements, and restore order. Store it somewhere available even if the secrets manager itself is down. A spare encrypted external drive can be one offline backup destination, but the drive alone is not a recovery plan; protect it and document how to use it.
Choose a consistency-aware backup method
A backup needs to represent a recoverable state, not just a collection of files copied while they are changing. Follow the instructions for the exact product, version, and storage backend. The OpenBao storage documentation says backups and restores are ideally performed while OpenBao is offline. If taking it offline is not feasible, it recommends a backend that supports atomic snapshots; for backends without atomic-snapshot support, it recommends offline backups.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
OpenBao’s documentation page is labeled Development, so check the documentation for the release you operate before relying on its current implementation-specific guidance. OpenBao does not provide built-in automated snapshots in that guidance; it describes external automation options, including cron, systemd units for VMs, and a Kubernetes CronJob example. Automation must be configured and monitored rather than assumed to be active.
Back up before upgrades and other major cluster changes. OpenBao’s current documentation also advises taking backups before, but not during, many writes to the /sys API, with endpoint exceptions. Because this is implementation-specific guidance, consult the documentation for your deployed release rather than treating it as a universal schedule or command checklist.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
OpenBao: include the backend and the operating setup
OpenBao’s backup approach depends on its storage backend. Use the OpenBao instructions for an officially supported backend; for another backend, follow that backend’s backup and restore procedures as well. A snapshot of stored data is encrypted, but that does not make every part of a recovery set harmless: configuration can contain sensitive values such as a Transit auto-unseal token or TLS private key.
- Preserve the persisted data using the consistency method appropriate to the backend.
- Save server configuration and service-management scripts needed to run the server again.
- Record how to reinstall user-installed plugins, where applicable.
- Restrict access to configuration and backup copies as carefully as access to live secrets.
Restoring an older OpenBao snapshot can discard valid changes made after it was taken. Before replacing live state, identify the snapshot’s time, assess intervening writes, and plan for the consequences of rolling back. A backup supports recovery from data loss or a bad change; it does not by itself keep an individual server available during a failure.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Bitwarden self-hosted: distinguish Docker from Helm
Bitwarden’s Backup Server Data guide says self-hosters are responsible for their own backup procedures. Its documented Docker and Helm recovery approaches differ, so first match the instructions to the deployment you run. Verify details against the documentation for your installed release, especially if the deployment uses an external database or differs from the documented setup.
Docker with the built-in database
For the documented Docker deployment with the built-in database, nightly database backups run while the mssql container is running and are retained in ./bwdata/mssql/backups for 30 days, according to Bitwarden’s guide accessed October 7, 2026. This retention detail does not apply to Bitwarden Lite, which does not take those nightly backups; Lite operators need to arrange their own backup process.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
For broader disaster recovery, Bitwarden recommends manually backing up the whole ./bwdata directory. The guide highlights these parts of the recovery set:
./bwdata/env— environment values, including database and certificate passwords../bwdata/core/attachments— attachments../bwdata/mssql/data— database data../bwdata/core/aspnet-dataprotection— framework-level data-protection material, including authentication tokens and some database columns.
Bitwarden documents restoring the database from a nightly backup with SQL Server tools and restarting the instance. Use that procedure only when your deployment matches the guide; do not assume that a database restore alone reconstructs the full instance. Keep the broader backup, including its environment values and data-protection material, available for the recovery.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Helm on Kubernetes
For Bitwarden Helm deployments, preserve the chart values file (for example, my-values.yaml), the Kubernetes Secrets object, and the relevant persistent volumes as well as the database backup. The guide identifies volumes for data protection, attachments, and licenses as recovery material. Its documented recovery approach is to deploy a new Helm installation with the saved values and Secrets, then reattach the preserved volumes and database backup. Protect exported Secrets and configuration as sensitive data.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Restore deliberately, then verify the service
A restore is a controlled rollback, not just a file-copy operation. Keep the affected service from accepting writes during the recovery process when the product’s procedure requires it, and make sure the backup corresponds to the deployment and version being recovered. Follow the official steps for that manager, backend, and deployment type; do not substitute OpenBao snapshot instructions for Bitwarden’s procedure or vice versa.
- Select the recovery point: identify the backup time and confirm that its data, configuration, and required credentials are available.
- Prepare the target: restore into the intended environment with the appropriate product version, configuration, storage, and deployment material.
- Apply the product-specific restore: use the manager’s documented method for its backend or deployment type. For Bitwarden Docker or Helm, use the matching branch in the official guide.
- Validate before normal use: check that the service starts, required data is present, and authentication and dependent functions work as expected. Avoid declaring recovery complete based only on a successful copy or process start.
Schedule controlled restore rehearsals appropriate to the service’s risk and operational requirements. The cited product documentation does not set a universal test cadence. A rehearsal can reveal missing keys, scripts, permissions, or deployment details before a real outage makes those omissions urgent.
Backups do not replace availability planning
A backup protects a recoverable copy of past state; it does not guarantee that the service stays online during a server failure. If the service requires continuity through individual infrastructure failures, plan separately for high availability. Conversely, replication or high availability should not be treated as a substitute for protected backups: a deletion or bad change may propagate to replicas. Choose both measures according to the recovery and availability needs of the deployment.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
